Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 13:19
General
- Target 4600b71b1eb1967c08212ba07fc0aa354400b31306e7d52af8a2329e592b4ff3.exe
- Size 25.6MB
- Sample261027-qkn47adf49
- SHA256 4600b71b1eb1967c08212ba07fc0aa354400b31306e7d52af8a2329e592b4ff3
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Fake Chrome/Google updater delivering miners 1 IoCs
- XMRig Miner payload 2 IoCs
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4600b71b1eb1967c08212ba07fc0aa354400b31306e7d52af8a2329e592b4ff3.exe"C:\Users\Admin\AppData\Local\Temp\4600b71b1eb1967c08212ba07fc0aa354400b31306e7d52af8a2329e592b4ff3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe"C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleSessionManager.exe"C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleSessionManager.exe" /watchu2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleUpdateCenter.exe"C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleUpdateCenter.exe" /user1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GoogleSessionManager.exe
guagent.dll
memory/116-23-0x0000000142000000-0x0000000142A30000-memory.dmp
memory/116-68-0x0000000142000000-0x0000000142A30000-memory.dmp
memory/116-85-0x000001EAB27B0000-0x000001EAB27D0000-memory.dmp
memory/116-87-0x00007FF6BA1B0000-0x00007FF6BBAF3000-memory.dmp
memory/1060-60-0x00007FF6AE4B0000-0x00007FF6AFDF3000-memory.dmp
memory/1832-2-0x00007FF6D2680000-0x00007FF6D3FC3000-memory.dmp
memory/1832-10-0x00007FF6D2680000-0x00007FF6D3FC3000-memory.dmp
memory/1832-86-0x00007FF6D2680000-0x00007FF6D3FC3000-memory.dmp
memory/3668-88-0x00007FF62CB10000-0x00007FF62E453000-memory.dmp
memory/3668-91-0x00007FF62CB10000-0x00007FF62E453000-memory.dmp